asyncrat | b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9

Sharing

Copy URL Twitter E-mail

General

Target
b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9
Size 45KB
Sample260816-jklwhafn21
SHA256 b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9
MD5 30cfd0bb8fc44a20e7710d0c058a435d
SHA1 cc5268e0834d3cbbf28db51d9cc232ec3c411f67
SHA512 739f1766be5ae06778b5c5092bba7d19e28123f7f2910e0804fc044cf33d3df1839432cd67bc2a2d4a3295fdd1fac84821328700c23ee7888c733a7ab6a9ee5f
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEaEPIQ2jbxgX3iM9Wxz4a7plUBDZUx:cuqb5TrhG2a4EapQ6b+XSMUxzf7bidUx
TLSH
T155232A003BE88127F2BE4F78A9F26145867AF6632603D58A1CC411DB5713FC6DA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

e.streamforester.name:80
e.streamforester.name:22
e.streamforester.name:8080
e.streamforester.name:8880
e.streamforester.name:2052
e.streamforester.name:2082
e.streamforester.name:2086
e.streamforester.name:2095
e.streamforester.name:443
e.streamforester.name:2053
e.streamforester.name:2083
e.streamforester.name:2087
e.streamforester.name:2096
e.streamforester.name:8443
www.e.streamforester.name:80
www.e.streamforester.name:22
www.e.streamforester.name:8080
www.e.streamforester.name:8880
www.e.streamforester.name:2052
www.e.streamforester.name:2082
www.e.streamforester.name:2086
www.e.streamforester.name:2095
www.e.streamforester.name:443
www.e.streamforester.name:2053
www.e.streamforester.name:2083
www.e.streamforester.name:2087
www.e.streamforester.name:2096
www.e.streamforester.name:8443
melissa.e.streamforester.name:80
melissa.e.streamforester.name:22
melissa.e.streamforester.name:8080
melissa.e.streamforester.name:8880
melissa.e.streamforester.name:2052
melissa.e.streamforester.name:2082
melissa.e.streamforester.name:2086
melissa.e.streamforester.name:2095
melissa.e.streamforester.name:443
melissa.e.streamforester.name:2053
melissa.e.streamforester.name:2083
melissa.e.streamforester.name:2087
melissa.e.streamforester.name:2096
melissa.e.streamforester.name:8443
notpetya.e.streamforester.name:80
notpetya.e.streamforester.name:22
notpetya.e.streamforester.name:8080
notpetya.e.streamforester.name:8880
notpetya.e.streamforester.name:2052
notpetya.e.streamforester.name:2082
notpetya.e.streamforester.name:2086
notpetya.e.streamforester.name:2095
notpetya.e.streamforester.name:443
notpetya.e.streamforester.name:2053
notpetya.e.streamforester.name:2083
notpetya.e.streamforester.name:2087
notpetya.e.streamforester.name:2096
notpetya.e.streamforester.name:8443
ryuk.e.streamforester.name:80
ryuk.e.streamforester.name:22
ryuk.e.streamforester.name:8080
ryuk.e.streamforester.name:8880
ryuk.e.streamforester.name:2052
ryuk.e.streamforester.name:2082
ryuk.e.streamforester.name:2086
ryuk.e.streamforester.name:2095
ryuk.e.streamforester.name:443
ryuk.e.streamforester.name:2053
ryuk.e.streamforester.name:2083
ryuk.e.streamforester.name:2087
ryuk.e.streamforester.name:2096
ryuk.e.streamforester.name:8443

Mutex

TELvHooBKPBd

Attributes

delay
0
install
true
install_file
oubr9.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9

File Explorer

b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9

.exe 45KB

b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9
MD5 30cfd0bb8fc44a20e7710d0c058a435d
SHA1 cc5268e0834d3cbbf28db51d9cc232ec3c411f67
SHA512 739f1766be5ae06778b5c5092bba7d19e28123f7f2910e0804fc044cf33d3df1839432cd67bc2a2d4a3295fdd1fac84821328700c23ee7888c733a7ab6a9ee5f
SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ0fBohEaEPIQ2jbxgX3iM9Wxz4a7plUBDZUx:cuqb5TrhG2a4EapQ6b+XSMUxzf7bidUx
TLSH
T155232A003BE88127F2BE4F78A9F26145867AF6632603D58A1CC411DB5713FC6DA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

b1a5b16af75a497de1e1eb40557d5e9b3ec301b7759917e0daccdd6ff9b46cc9

mscoree

dotnet